Fortinet FCP_FGT_AD-7.4 - Questions & Answers

IPsec security associations IPsec security associations (SAs) are synchronized between HA members to ensure seamless failover and continuity of VPN tunnels.
DHCP leases DHCP lease information is synchronized between HA members to maintain consistent IP address assignments and prevent disruptions when failover occurs.

FGCP elects the primary FortiGate device FGCP is responsible for electing the primary (active) device in a FortiGate HA (High Availability) cluster, ensuring proper role assignment between the primary and secondary devices.
FGCP runs only over the heartbeat links FGCP runs over the dedicated heartbeat links between FortiGate devices in the HA cluster, ensuring synchronization and communication between the devices for failover and redundancy purposes.

The Fortinet Single Sign-On (FSSO) Collector Agent supports three primary methods for Active Directory (AD) polling to collect user information: WinSecLog:Monitors Windows Security Event Logs for login events. WMI:Uses Windows Management Instrumentation to poll user login sessions. NetAPI:Utilizes the Netlogon API to query domain controllers for user session data.
These methods allow the FortiGate to gather user logon information and enforce user-based policies effectively.
References:
FortiOS 7.4.1 Administration Guide: FSSO Configuration

When a certificate fails for any of the reasons above, you can configure any of the following actions: ?Keep untrusted&; Allow: FortiGate allows the website and lets the browser decide the action to take. FortiGate
takes the certificate as untrusted. ?Block: FortiGate blocks the content of the site. ?Trust&; Allow: FortiGate allows the website and takes the
certificate as trusted.

Based on the system performance output provided, the memory usage on the FortiGate device is at 90%, which is above the green threshold (82%) but below the red threshold (88%). Given this high memory usage, the FortiGate device will enter "conserve mode" to prevent further resource exhaustion. In conserve mode:
B. FortiGate has entered conserve mode:When the memory usage reaches or exceeds certain thresholds
(in this case, the green and red thresholds), the FortiGate enters conserve mode to protect itself from running out of memory entirely. This mode limits some functionalities to reduce memory usage and avoid a potential system crash.
D. Administrators can access FortiGate only through the console port:During conserve mode,
administrative access might be restricted, and administrators may only be able to connect to the device via the console port. This restriction is in place to ensure that the FortiGate can be managed directly, even under low resource conditions.
The other options are not correct:
A. FortiGate will start sending all files to FortiSandbox for inspection:This is unrelated to memory usage
and conserve mode.
C. Administrators cannot change the configuration:While access may be limited, configuration changes
can still be made via the console port.
References
FortiOS 7.4.1 Administration Guide -Monitoring System Resources and Performance, page 325.
FortiOS 7.4.1 Administration Guide -Conserve Mode, page 330.

To resolve the issue of PC3 not being able to access the internet, the administrator needs to adjust the IP pool configuration or the firewall policy. The following two options will fix the connectivity issue:
B. In the IP pool configuration, set the ending IP to 192.2.0.12:The current IP pool range is 192.2.0.10-
192.2.0.11, which only provides two IP addresses for network address translation (NAT). To allow PC3 to access the internet, the IP pool should be expanded to include an additional IP address by changing the end of the range to 192.2.0.12.
D. In the IP pool configuration, set type to overload:Instead of using a one-to-one NAT, changing the type
to overload will allow multiple internal addresses (such as PC1, PC2, and PC3) to share a single external IP address. This will solve the issue without needing additional public IP addresses.
The other options are not suitable:
A. In the firewall policy configuration, add 10.0.1.3 as an address object in the source field:This option is
unnecessary since the firewall policy already allows all addresses from the source (LAN port3).
C. Configure another firewall policy that matches only the address of PC3 as the source, and then place
the policy on top of the list:This option is redundant and would not resolve the underlying issue with the IP pool configuration.
References
FortiOS 7.4.1 Administration Guide -Configuring Firewall Policies, page 512. FortiOS 7.4.1 Administration
Guide -Configuring NAT with IP Pools, page 518.